Add your file
Choose or drop a .txt or .jwt file. You can paste the contents instead.
JWT Decoder: Read a Token's Header, Payload and Expiry
Paste a full token or pick a .txt or .jwt file and the decoder splits the three segments. The header and payload are Base64url-decoded, read as strict UTF-8 and parsed as strict JSON, then shown exactly as decoded so you can copy them or download them as .header.json and .payload.json. Header fields alg, typ, cty, kid, jku and x5u are listed on their own. The registered claims iss, sub, aud, exp, nbf, iat and jti appear as standard claims, and exp, nbf and iat are shown both as the raw number and as a UTC date, with expired and not-yet-valid checks against your device clock. A table lists every top-level claim with its raw value, so large integers keep their exact digits. The signature segment is only checked for valid Base64url and measured in bytes; it is never turned into text. Notices flag alg none, a missing exp, remote key URLs and duplicate keys.
File types: .txt, .jwtProcessing: This browser
or drop a file here
✓ Stays on this deviceMaximum size: 977 KB
How to use JWT Decoder: Read a Token's Header, Payload and Expiry
Let it read the file
The file is read and parsed in this browser — nothing is uploaded.
Check the result
Look over what came back, then copy it, download it, or move on.
Want to know how files are handled? Read the privacy notice →
Common questions
How do I decode a JWT online and see its header and payload?
Paste the whole token into the input box or choose a .txt or .jwt file, and the decoded header and payload JSON appear immediately. Surrounding spaces and line breaks are trimmed. The result is split into header JSON, payload JSON, header fields, standard claims, an all-claims table and the signature, with the not-verified notice at the top.
Can I decode a JWT without uploading the token to a server?
Yes. The token is decoded inside your browser tab and is never sent to a server by this tool. Even when the header names a jku or x5u URL, the decoder only lists it with a warning and does not contact that address.
How do I view a JWT payload on Mac or Windows without installing anything?
Open this page in any current browser on Mac, Windows, Linux or a phone and paste the token; no CLI, package or extension is needed. Copy the token from your browser's developer tools, an API client or a log line, then paste only the part starting with eyJ.
Why does the JWT decoder say the token has the wrong number of segments?
A signed JWT must contain exactly three parts separated by two dots, so a missing or extra dot triggers this error. Typical causes are a signature cut off while copying or two tokens pasted together. Exactly five parts produce a separate message, because that shape is an encrypted JWE.
What does an invalid JSON payload error mean when decoding a JWT?
It means the payload decoded from Base64url but is not strict JSON, so it is reported as an error instead of being shown as text. Single quotes, trailing commas or bad escapes cause it. A separate message appears when the JSON is valid but is an array or string rather than an object.
Why is a JWT rejected for invalid base64url characters when I paste a Bearer header?
The word Bearer and the space after it are not Base64url characters, so the first segment fails to decode. The error reports the line and column of the offending character; remove the prefix, quotes or a stray line break and paste only the token.
How large a JWT file can the decoder open, and which encoding does it need?
Tokens and files up to 1,000,000 bytes are accepted, files must be UTF-8 text, and JSON may nest up to 64 levels. A file saved as UTF-16 is rejected as not UTF-8. A byte order mark at the start of a file is removed, but one hidden inside a decoded segment is not silently stripped.
Can this JWT decoder decode a JWE encrypted token?
No. Only three-part signed tokens (JWS) are decoded; five-part JWE encrypted tokens are rejected with their own message. A JWS payload is merely encoded and readable by anyone, while JWE content can only be read with the appropriate decryption key. Unencoded payloads declared with b64: false are not supported either.
Does the JWT decoder verify the signature or prove the token is genuine?
No. The signature is never verified and no key is accepted, so a cleanly decoded token is not proof of authenticity. Anyone can craft a JWT that decodes perfectly. The signature panel shows only the raw segment and its byte length; trust decisions belong to the server holding the key.
Is a JWT with alg none a vulnerability?
It can be: alg none claims the token is unsigned, and any server that accepts it lets attackers forge identities. The decoder raises a critical warning for none in any letter case. If your backend accepts such tokens, reject them explicitly in its verification code.
How does the JWT decoder convert an exp timestamp to a date and decide if it is expired?
exp, iat and nbf are read as seconds since 1970 and shown as UTC dates next to the raw number; expiry is judged against your device clock. A wrong clock gives a wrong verdict, and server clock-skew allowances are not applied. A token without exp is flagged as missing it, not treated as valid forever.
Is it safe when a JWT header contains jku or x5u URLs?
Treat it with caution: the decoder flags jku and x5u as remote key references and never fetches them. A server that downloads keys from whatever URL the token names can be tricked into trusting an attacker's key, so these fields should only be honoured against an allow-list.
Does decoding a JWT change big integer claims or number precision?
No. The claims table shows each value exactly as written in the payload, so long numeric IDs, exponents and trailing zeros keep their original digits. The header and payload panels also show the decoded JSON text unchanged, and copying or downloading keeps it byte-for-byte.